undefined | Better HN

0 pointslossolo6y ago0 comments

> doesn't really solve the problem.

Care to elaborate? It solves authentication for us and we are using it for 10+ years like this.

> is a problem with the architectural decisions modern IRC has inherited. It cannot be fixed because it depends on persistent TCP connections and that is not the way the internet works.

Let me check my current znc IRC session signon: Wed Jul 18 07:43:12

So almost a year.

0 comments

KirinDave6y ago

> Care to elaborate? It solves authentication for us and we are using it for 10+ years like this

If "we use plaintext passwords communicated to a faux user" is your idea of "solved" then we have very different standards.

> Let me check my current znc IRC session signon: Wed Jul 18 07:43:12

Congrats on being rich and lucky I guess? That's not a thing most folks can replicate at scale. I have had more than one IP address in the duration of writing this post.

lossoloOP6y ago

> If "we use plaintext passwords communicated to a faux user" is your idea of "solved" then we have very different standards.

plaintext? In our use case TLS usage is mandatory and passwords are not stored in plaintext. I think your knowledge about how IRC is used now is a little outdated.

> Congrats on being rich and lucky I guess? That's not a thing most folks can replicate at scale. I have had more than one IP address in the duration of writing this post.

VPN -> znc -> IRC

You don't need to be rich and lucky to replicate this. Signon time was from znc to irc, not from my home connection to irc.

KirinDave6y ago

> plaintext? TLS usage is mandatory and passwords are not stored in plaintext. I think your knowledge about how IRC is used now is a little outdated.

Actually I wondered if that might be the case so I checked TFM: https://freenode.net/kb/answer/registration

Plaintext negotiation is my complaint. I doubt we'd be discussing this if it was plaintext storage. Not even the most fanatical IRC proponent would be okay with that.

> TLS usage is mandatory and passwords are not stored in it plaintext. I think your knowledge about how IRC is used now is a little outdated.

> VPN -> znc -> IRC

Where is your znc hosted? How much does it cost? Are you paying for a VPN service (please no)?

Even having a decent in-home internet connection, a way to route traffic back into your network, and a raspberry pi to host it on is a tall order.

2 more replies

aidenn06y ago

I agree with you on persistent logs, but I authenticate with an SSL client certificate, not a password. This is supported by several networks. Also, what do you mean by "plaintext"? Good id services will store a hashed password and the irc connection can be over SSL. That's no more plaintext than any web service login.

KirinDave6y ago

The difference being that there are absolutely no better options. Everyone agrees the login form model is insufficient and that's why anyone who takes personal security seriously now introduces a lot of infrastructure around their logins.

But aside, it seems like not all networks support TLS logins?

As it stands, I have no IRC equivalent of a 2FA key. I present a plaintext token and hope that it's all handled properly and that I'm not a victim of a password reuse attack.

Any web based solution is light years ahead on this.

1 more reply

j / k navigate · click thread line to collapse

0 comments

KirinDave6y ago

> Care to elaborate? It solves authentication for us and we are using it for 10+ years like this

If "we use plaintext passwords communicated to a faux user" is your idea of "solved" then we have very different standards.

> Let me check my current znc IRC session signon: Wed Jul 18 07:43:12

Congrats on being rich and lucky I guess? That's not a thing most folks can replicate at scale. I have had more than one IP address in the duration of writing this post.

lossoloOP6y ago

> If "we use plaintext passwords communicated to a faux user" is your idea of "solved" then we have very different standards.

plaintext? In our use case TLS usage is mandatory and passwords are not stored in plaintext. I think your knowledge about how IRC is used now is a little outdated.

> Congrats on being rich and lucky I guess? That's not a thing most folks can replicate at scale. I have had more than one IP address in the duration of writing this post.

VPN -> znc -> IRC

You don't need to be rich and lucky to replicate this. Signon time was from znc to irc, not from my home connection to irc.

KirinDave6y ago

> plaintext? TLS usage is mandatory and passwords are not stored in plaintext. I think your knowledge about how IRC is used now is a little outdated.

Actually I wondered if that might be the case so I checked TFM: https://freenode.net/kb/answer/registration

Plaintext negotiation is my complaint. I doubt we'd be discussing this if it was plaintext storage. Not even the most fanatical IRC proponent would be okay with that.

> TLS usage is mandatory and passwords are not stored in it plaintext. I think your knowledge about how IRC is used now is a little outdated.

> VPN -> znc -> IRC

Where is your znc hosted? How much does it cost? Are you paying for a VPN service (please no)?

Even having a decent in-home internet connection, a way to route traffic back into your network, and a raspberry pi to host it on is a tall order.

2 more replies

aidenn06y ago

KirinDave6y ago

But aside, it seems like not all networks support TLS logins?

As it stands, I have no IRC equivalent of a 2FA key. I present a plaintext token and hope that it's all handled properly and that I'm not a victim of a password reuse attack.

Any web based solution is light years ahead on this.

1 more reply

j / k navigate · click thread line to collapse